Executive brief
A bug in the Linux kernel's BPF (Berkeley Packet Filter) subsystem can cause a system crash when BPF cgroup_skb programs run while a task is exiting. The vulnerability occurs in the bpf_task_from_vpid() function, which fails to check if the current task has a valid process ID namespace before attempting to access it. An attacker with privileges to load and run BPF programs can trigger this crash, resulting in a denial of service.
Technical details
The vulnerability is a NULL pointer dereference in the bpf_task_from_vpid() kernel BPF helper function located in kernel/bpf/helpers.c. The function calls find_task_by_vpid(), which in turn calls task_active_pid_ns(current) to obtain the current task's PID namespace. However, when cgroup_skb BPF programs run in softirq context, they may interrupt a task that is executing in do_exit(). Once a task passes __unhash_process() during exit, its thread_pid is cleared, causing task_active_pid_ns() to return NULL. The subsequent call to find_pid_ns() then dereferences the NULL pointer when accessing the namespace's idr structure. The fix adds a NULL check on task_active_pid_ns(current) and returns NULL early if no valid PID namespace exists, preventing the dereference. The patch has been merged into the Linux kernel mainline and backported to stable versions.
Affected products
- Linux Linux kernel Versions prior to the fix (introduced in commit 675c3596ff32); affects kernels with BPF cgroup_skb support
Timeline
- 2026-08-15: disclosed: Published on NVD
- 2026-06-08: patched: Upstream patch committed by Kumar Kartikeya Dwivedi
- 2026-07-24: other: Backported to stable kernels via commit a4c95b6221cb2972a94ed72663c09bd5b0b6dea4